CVE-2025-0757

Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users. (CWE-79)   Description   Hitachi Vantara Pentaho Business Analytics Server prior to versions 10.2.0.2, including 9.3.x and 8.3.x, allow a malicious URL to inject content into the Analyzer plugin interface.   Impact   Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.

• CWE-79

• https://support.pentaho.com/hc/en-us/articles/35781038882445--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Improper-Neutralization-of-Input-During-Web-Page-Generation-Cross-site-Scripting-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-0757

Published

Apr 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0751A vulnerability classified as critical has been found in Axi…6.5
• CVE-2025-0752A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. …7.1
• CVE-2025-0753A vulnerability classified as critical was found in Axiomati…6.5
• CVE-2025-0754The vulnerability was found in OpenShift Service Mesh 2.6.3 …4.3
• CVE-2025-0755The various bson_append functions in the MongoDB C driver li…7.5
• CVE-2025-0756Overview   The product receives input from an upstrea…9.1
• CVE-2025-0758Overview  The product specifies permissions for a securit…6.1
• CVE-2025-0759IBM EntireX 11.1 could allow a local user to unintentionally…3.3
• CVE-2025-0760A Credential Disclosure vulnerability exists where an admini…2.7
• CVE-2025-0762Use after free in DevTools in Google Chrome prior to 132.0.6…8.8
• CVE-2025-0763The Ultimate Classified Listings plugin for WordPress is vul…4.3
• CVE-2025-0764The wpForo Forum plugin for WordPress is vulnerable to arbit…6.5